Client cert authentication (aka mutual tls) works perfectly fine on HTTP/2 (as it happens on a completely unrelated protocol layer), so my question is just what did you deploy that broke it?

It doesn't "just work", because it's a HTTP authentication flavour that happens to occur at the Transport layer.

Because it crosses layers like this, HTTP has to know about the transport.

For example, it's possible in HTTP 1.1 to have a page trigger cert auth even though the initial transport didn't use it! This is common for logging on to pages using Smart Cards but leaving an option to use alternate authentication modes.

This was just... abandoned in HTTP/2 (and HTTP/3) as "too hard".

Or more accurately, every authentication mode not used by Google was abandoned and does not work.

I've tried HTTP/2 with products from numerous vendors, and without fail anything Google doesn't use... didn't work.

Are you talking about mutual TLS, or are you talking about Negotiate? Because the only way to trigger cert auth (under mtls) if the initial transport didn't use it is to force a TLS renegotiation, as it's handled by sending a CertificateRequest message at TLS layer.

Windows Integrated Authentication however triggers authentication by sending Negotiate header and performing HTTP-level exchange.

N.B. Every example of page triggering cert login later on that I have encountered in the wild forced a fresh connection and thus mutual authentication.